CVE-2017-6324 Security feature bypass in Messaging Gateway
Attackers can bypass the disarm functionality in Symantec Messaging Gateway by sending malformed Word files with malicious macros, allowing potentially harmful content to pass through.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-6324?
CVE-2017-6324 is a high-severity vulnerability in Symantec Corporation Messaging Gateway, published on 26 Jun 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Symantec Messaging Gateway, when processing a specific email attachment, can allow a malformed or corrupted Word file with a potentially malicious macro through despite the administrator having the 'disarm' functionality enabled. This constitutes a 'bypass' of the disarm functionality resident to the application.
Which versions are affected by CVE-2017-6324?
It affects 1 product.
Products include Symantec Messaging Gateway.
How do I fix CVE-2017-6324?
No fix has been published for CVE-2017-6324 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-6324 being exploited?
There is no known exploitation of CVE-2017-6324 in the wild and no public exploit code.
Other vulnerabilities in Symantec Corporation Messaging Gateway
Sources
Also known as GHSA-63mf-j3v5-8x67.